[Silicon Defense logo]

SnortSnarf alert page

Source: 24.61.174.158

SnortSnarf v021111.1

Signature section (91123)Top 20 source IPsTop 20 dest IPs

18 such alerts found using input module SnortFileInput, with sources:
Earliest: 13:05:10.087693 on 06/15/2003
Latest: 13:05:27.737089 on 06/15/2003

6 different signatures are present for 24.61.174.158 as a source

There are 1 distinct destination IPs in the alerts of the type on this page.

24.61.174.158 Whois lookup at: ARIN RIPE APNIC Geektools
DNS lookup at: Amenesi TRIUMF Princeton
More lookup links: Dshield Sam Spade

[**] [1:1256:7] WEB-IIS CodeRed v2 root.exe access [**]
[Classification: Web Application Attack] [Priority: 1]
06/15-13:05:10.087693 24.61.174.158:51146 -> 192.168.1.6:80
TCP TTL:14 TOS:0x0 ID:39258 IpLen:20 DgmLen:112 DF
***AP*** Seq: 0x87EB288 Ack: 0xC6FDD6E7 Win: 0x2000 TcpLen: 20
[Xref => http://www.cert.org/advisories/CA-2001-19.html]
[**] [1:1256:7] WEB-IIS CodeRed v2 root.exe access [**]
[Classification: Web Application Attack] [Priority: 1]
06/15-13:05:12.887380 24.61.174.158:51146 -> 192.168.1.6:80
TCP TTL:14 TOS:0x0 ID:39868 IpLen:20 DgmLen:112 DF
***AP*** Seq: 0x87EB288 Ack: 0xC6FDD6E7 Win: 0x2000 TcpLen: 20
[Xref => http://www.cert.org/advisories/CA-2001-19.html]
[**] [1:1256:7] WEB-IIS CodeRed v2 root.exe access [**]
[Classification: Web Application Attack] [Priority: 1]
06/15-13:05:15.203565 24.61.174.158:51487 -> 192.168.1.6:80
TCP TTL:14 TOS:0x0 ID:40482 IpLen:20 DgmLen:110 DF
***AP*** Seq: 0x993928B Ack: 0xC6DE79AB Win: 0x2000 TcpLen: 20
[Xref => http://www.cert.org/advisories/CA-2001-19.html]
[**] [1:1002:5] WEB-IIS cmd.exe access [**]
[Classification: Web Application Attack] [Priority: 1]
06/15-13:05:15.585326 24.61.174.158:51528 -> 192.168.1.6:80
TCP TTL:14 TOS:0x0 ID:40595 IpLen:20 DgmLen:120 DF
***AP*** Seq: 0x9B452CE Ack: 0xC6A393CE Win: 0x2000 TcpLen: 20
[**] [1:1002:5] WEB-IIS cmd.exe access [**]
[Classification: Web Application Attack] [Priority: 1]
06/15-13:05:15.778554 24.61.174.158:51584 -> 192.168.1.6:80
TCP TTL:14 TOS:0x0 ID:40726 IpLen:20 DgmLen:120 DF
***AP*** Seq: 0x9DE5A58 Ack: 0xC6D52171 Win: 0x2000 TcpLen: 20
[**] [1:1945:1] WEB-IIS unicode directory traversal attempt [**]
[Classification: Web Application Attack] [Priority: 1]
06/15-13:05:15.987600 24.61.174.158:51596 -> 192.168.1.6:80
TCP TTL:14 TOS:0x0 ID:40780 IpLen:20 DgmLen:136 DF
***AP*** Seq: 0x9E7BDE7 Ack: 0xC6F57116 Win: 0x2000 TcpLen: 20
[Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0884]
[**] [1:1288:5] WEB-FRONTPAGE /_vti_bin/ access [**]
[Classification: access to a potentially vulnerable web application] [Priority: 2]
06/15-13:05:16.374129 24.61.174.158:51604 -> 192.168.1.6:80
TCP TTL:14 TOS:0x0 ID:40928 IpLen:20 DgmLen:157 DF
***AP*** Seq: 0x9EF2B54 Ack: 0xC6FE5CDB Win: 0x2000 TcpLen: 20
[**] [1:1286:5] WEB-IIS _mem_bin access [**]
[Classification: access to a potentially vulnerable web application] [Priority: 2]
06/15-13:05:16.556527 24.61.174.158:51678 -> 192.168.1.6:80
TCP TTL:14 TOS:0x0 ID:40965 IpLen:20 DgmLen:157 DF
***AP*** Seq: 0xA2AA0C3 Ack: 0xC685F21C Win: 0x2000 TcpLen: 20
[**] [1:982:6] WEB-IIS unicode directory traversal attempt [**]
[Classification: Web Application Attack] [Priority: 1]
06/15-13:05:17.280962 24.61.174.158:51707 -> 192.168.1.6:80
TCP TTL:14 TOS:0x0 ID:41127 IpLen:20 DgmLen:185 DF
***AP*** Seq: 0xA42B0D2 Ack: 0xC6B1294C Win: 0x2000 TcpLen: 20
[Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0884]
[**] [1:982:6] WEB-IIS unicode directory traversal attempt [**]
[Classification: Web Application Attack] [Priority: 1]
06/15-13:05:17.966373 24.61.174.158:51761 -> 192.168.1.6:80
TCP TTL:14 TOS:0x0 ID:41302 IpLen:20 DgmLen:137 DF
***AP*** Seq: 0xA6E2170 Ack: 0xC7788848 Win: 0x2000 TcpLen: 20
[Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0884]
[**] [1:1002:5] WEB-IIS cmd.exe access [**]
[Classification: Web Application Attack] [Priority: 1]
06/15-13:05:21.757095 24.61.174.158:51807 -> 192.168.1.6:80
TCP TTL:14 TOS:0x0 ID:42233 IpLen:20 DgmLen:137 DF
***AP*** Seq: 0xA9213E3 Ack: 0xC7066DB2 Win: 0x2000 TcpLen: 20
[**] [1:981:6] WEB-IIS unicode directory traversal attempt [**]
[Classification: Web Application Attack] [Priority: 1]
06/15-13:05:22.732403 24.61.174.158:52060 -> 192.168.1.6:80
TCP TTL:14 TOS:0x0 ID:42438 IpLen:20 DgmLen:137 DF
***AP*** Seq: 0xB5DA702 Ack: 0xC79FFD33 Win: 0x2000 TcpLen: 20
[Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0884]
[**] [1:983:6] WEB-IIS unicode directory traversal attempt [**]
[Classification: Web Application Attack] [Priority: 1]
06/15-13:05:23.078847 24.61.174.158:52099 -> 192.168.1.6:80
TCP TTL:14 TOS:0x0 ID:42569 IpLen:20 DgmLen:137 DF
***AP*** Seq: 0xB7C9B4C Ack: 0xC70A3DBE Win: 0x2000 TcpLen: 20
[Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0884]
[**] [1:970:5] WEB-IIS multiple decode attempt [**]
[Classification: Web Application Attack] [Priority: 1]
06/15-13:05:23.479031 24.61.174.158:52130 -> 192.168.1.6:80
TCP TTL:14 TOS:0x0 ID:42691 IpLen:20 DgmLen:138 DF
***AP*** Seq: 0xB960537 Ack: 0xC744F303 Win: 0x2000 TcpLen: 20
[Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-0333]
[**] [1:970:5] WEB-IIS multiple decode attempt [**]
[Classification: Web Application Attack] [Priority: 1]
06/15-13:05:23.642734 24.61.174.158:52155 -> 192.168.1.6:80
TCP TTL:14 TOS:0x0 ID:42811 IpLen:20 DgmLen:136 DF
***AP*** Seq: 0xBAA4715 Ack: 0xC709D13A Win: 0x2000 TcpLen: 20
[Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-0333]
[**] [1:970:5] WEB-IIS multiple decode attempt [**]
[Classification: Web Application Attack] [Priority: 1]
06/15-13:05:26.721590 24.61.174.158:52155 -> 192.168.1.6:80
TCP TTL:14 TOS:0x0 ID:43656 IpLen:20 DgmLen:136 DF
***AP*** Seq: 0xBAA4715 Ack: 0xC709D13A Win: 0x2000 TcpLen: 20
[Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-0333]
[**] [1:970:5] WEB-IIS multiple decode attempt [**]
[Classification: Web Application Attack] [Priority: 1]
06/15-13:05:26.978427 24.61.174.158:52411 -> 192.168.1.6:80
TCP TTL:14 TOS:0x0 ID:43757 IpLen:20 DgmLen:140 DF
***AP*** Seq: 0xC79343B Ack: 0xC8090282 Win: 0x2000 TcpLen: 20
[Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-0333]
[**] [1:1002:5] WEB-IIS cmd.exe access [**]
[Classification: Web Application Attack] [Priority: 1]
06/15-13:05:27.737089 24.61.174.158:52456 -> 192.168.1.6:80
TCP TTL:14 TOS:0x0 ID:43974 IpLen:20 DgmLen:136 DF
***AP*** Seq: 0xC9CAC45 Ack: 0xC7AEF965 Win: 0x2000 TcpLen: 20
SnortSnarf brought to you courtesy of Silicon Defense
Authors: Jim Hoagland and Stuart Staniford
See also the Snort Page by Marty Roesch
Page generated at Tue Jun 17 09:03:52 2003